Name

ipsets — Specifying the name if an ipset in Shorewall configuration files

Synopsis

+ipsetname

+ipsetname[flag,...]

+[ipsetname,...]

Description

Note: In the above syntax descriptions, the square brackets ("[]")
are to be taken literally rather than as meta-characters.

In most places where a network address may be entered, an ipset may
be substituted. Set names must be prefixed by the character "+", must
start with a letter and may be composed of alphanumeric characters, "-"
and "_".

Whether the set is matched against the packet source or destination
is determined by which column the set name appears (SOURCE or DEST). For
those set types that specify a tuple, two alternative syntaxes are
available:

[number] - Indicates that 'src' or
'dst' should be repeated number times.
Example: myset[2].

[flag,...] where
flag is src or
dst. Example: myset[src,dst].

In a SOURCE or SPORT column, the following pairs are
equivalent:

+myset[2] and +myset[src,src]

In a DEST or DPORT column, the following pairs are
equivalent:

+myset[2] and +myset[dst,dst]

Beginning with Shorewall 4.4.14, multiple source or destination
matches may be specified by enclosing the set names within +[...]. The set
names need not be prefixed with '+'. When such a list of sets is
specified, matching packets must match all of the listed sets.

Important

If the set type supports the nomatch flag, then the matching
is reversed: a match with an element flagged with nomatch returns
true, while a match with a plain element returns false. This option
requires the 'Ipset Match nomatch' capability in your kernel and
ip[6]tables.

no-update-counters

The packet and byte counters of the matching element in the
set won't be updated. By default, the packet and byte counters are
updated. This option and those that follow require the 'Ipset Match
counters' capability in your kernel and ip[6]tables.

no-update-subcounters

The packet and byte counters of the matching element in the
member set of a list type of set won't be updated. Default the
packet and byte counters are updated.

packets=value

If the packet is matched an element in the set, match only if
the packet counter of the element matches the given
value also.

packets<value

If the packet is matched an element in the set, match only if
the packet counter of the element is less than the given
value as well.

packets>value

If the packet is matched an element in the set, match only if
the packet counter of the element is greater than the given
value as well.

packets!=value

If the packet is matched an element in the set, match only if
the packet counter of the element does not match the given
value also.

bytes=value

If the packet is matched an element in the set, match only if
the byte counter of the element matches the given
value also.

bytes<value

If the packet is matched an element in the set, match only if
the byte counter of the element is less than the given
value as well.

bytes>value

If the packet is matched an element in the set, match only if
the byte counter of the element is greater than the given
value as well.

bytes<>value

If the packet is matched an element in the set, match only if
the byte counter of the element does not match the given
value also.

Examples

In the examples that follow, myset,
myset1 and myset2 are ipsets
and myObject is an NFacct object name.

+myset

+myset[src]

+myset[2]

+[myset1,myset2[dst]]

+myset[src](myObject)

+myset[src,nomatch,packets>100]

+myset[nomatch,no-update-counters](myObject)

FILES

/etc/shorewall/accounting

/etc/shorewall/blrules

/etc/shorewall/hosts -- Note:
Multiple matches enclosed in +[...] may not be used in this file.

/etc/shorewall/maclist -- Note:
Multiple matches enclosed in +[...] may not be used in this file.